group ID number of the process as a
decimal integer. (alias gid).
egroup EGROUP effective group ID of the process. This will be
the textual group ID, if it can be obtained and
the field width permits, or a decimal
representation otherwise. (alias group).
eip EIP instruction pointer. As of kernel 4.9.xx will be
zeroed out unless task is exiting or being core
dumped.
esp ESP stack pointer. As of kernel 4.9.xx will be zeroed
out unless task is exiting or being core dumped.
etime ELAPSED elapsed time since the process was started, in the
form [[DD-]hh:]mm:ss.
etimes ELAPSED elapsed time since the process was started, in
seconds.
euid EUID effective user ID (alias uid).
euser EUSER effective user name. This will be the textual
user ID, if it can be obtained and the field width
permits, or a decimal representation otherwise.
The n option can be used to force the decimal
representation. (alias uname, user).
exe EXE path to the executable. Useful if path cannot be
printed via cmd, comm or args format options.
f F flags associated with the process, see the PROCESS
FLAGS section. (alias flag, flags).
fgid FGID filesystem access group ID. (alias fsgid).
fgroup FGROUP filesystem access group ID. This will be the
textual group ID, if it can be obtained and the
field width permits, or a decimal representation
otherwise. (alias fsgroup).
flag F see f. (alias f, flags).
flags F see f. (alias f, flag).
fname COMMAND first 8 bytes of the base name of the process’s
executable file. The output in this column may
contain spaces.
fuid FUID filesystem access user ID. (alias fsuid).
fuser FUSER filesystem access user ID. This will be the
textual user ID, if it can be obtained and the
field width permits, or a decimal representation
otherwise.
gid GID see egid. (alias egid).
group GROUP see egroup. (alias egroup).
ignored IGNORED mask of the ignored signals, see signal(7).
According to the width of the field, a 32 or 64
bits mask in hexadecimal format is displayed.
(alias sig_ignore, sigignore).
ipcns IPCNS Unique inode number describing the namespace the
process belongs to. See namespaces(7).
label LABEL security label, most commonly used for SELinux
context data. This is for the Mandatory Access
Control ("MAC") found on high-security systems.
lstart STARTED time the command started. This will be in the form
"DDD mmm HH:MM:SS YYY" unless changed by the -D
option.
lsession SESSION displays the login session identifier of a
process, if systemd support has been included.
luid LUID